RE: How can i protect against session hijacking?

["Martin O'Neal" <martin.oneal () corsaire com>]

> If an attacker gets hold of the end 
> users cookies (through XSS and so
> forth), how can you actually prevent 
> session hijacking?

The short answer is that you can't (and most of the things you can try
to compensate with wont work, but will break something else, or impact
on the user experience);  as soon as you have lost the session ID, then
you have lost the session ID.

Focus your efforts on not losing the session ID.  Just my 2p. :)

Martin...